/*
 * IEEE 802.11 Common routines
 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Alternatively, this software may be distributed under the terms of BSD
 * license.
 *
 * See README and COPYING for more details.
 */

#include "includes.h"

#include "common.h"
#include "ieee802_11_defs.h"
#include "ieee802_11_common.h"


static int ieee802_11_parse_vendor_specific(const u8 *pos, size_t elen,
        struct ieee802_11_elems *elems,
        int show_errors)
{
    unsigned int oui;

    /* first 3 bytes in vendor specific information element are the IEEE
     * OUI of the vendor. The following byte is used a vendor specific
     * sub-type. */
    if (elen < 4) {
        if (show_errors) {
            wpa_printf(MSG_MSGDUMP, "short vendor specific "
                    "information element ignored (len=%lu)",
                    (unsigned long) elen);
        }
        return -1;
    }

    oui = WPA_GET_BE24(pos);
    switch (oui) {
        case OUI_MICROSOFT:
            /* Microsoft/Wi-Fi information elements are further typed and
             * subtyped */
            switch (pos[3]) {
                case 1:
                    /* Microsoft OUI (00:50:F2) with OUI Type 1:
                     * real WPA information element */
                    elems->wpa_ie = pos;
                    elems->wpa_ie_len = elen;
                    break;
                case WMM_OUI_TYPE:
                    /* WMM information element */
                    if (elen < 5) {
                        wpa_printf(MSG_MSGDUMP, "short WMM "
                                "information element ignored "
                                "(len=%lu)",
                                (unsigned long) elen);
                        return -1;
                    }
                    switch (pos[4]) {
                        case WMM_OUI_SUBTYPE_INFORMATION_ELEMENT:
                        case WMM_OUI_SUBTYPE_PARAMETER_ELEMENT:
                            /*
                             * Share same pointer since only one of these
                             * is used and they start with same data.
                             * Length field can be used to distinguish the
                             * IEs.
                             */
                            elems->wmm = pos;
                            elems->wmm_len = elen;
                            break;
                        case WMM_OUI_SUBTYPE_TSPEC_ELEMENT:
                            elems->wmm_tspec = pos;
                            elems->wmm_tspec_len = elen;
                            break;
                        default:
                            wpa_printf(MSG_MSGDUMP, "unknown WMM "
                                    "information element ignored "
                                    "(subtype=%d len=%lu)",
                                    pos[4], (unsigned long) elen);
                            return -1;
                    }
                    break;
                case 4:
                    /* Wi-Fi Protected Setup (WPS) IE */
                    elems->wps_ie = pos;
                    elems->wps_ie_len = elen;
                    break;
                default:
                    wpa_printf(MSG_MSGDUMP, "Unknown Microsoft "
                            "information element ignored "
                            "(type=%d len=%lu)\n",
                            pos[3], (unsigned long) elen);
                    return -1;
            }
            break;

        case OUI_BROADCOM:
            switch (pos[3]) {
                case VENDOR_HT_CAPAB_OUI_TYPE:
                    elems->vendor_ht_cap = pos;
                    elems->vendor_ht_cap_len = elen;
                    break;
                default:
                    wpa_printf(MSG_MSGDUMP, "Unknown Broadcom "
                            "information element ignored "
                            "(type=%d len=%lu)\n",
                            pos[3], (unsigned long) elen);
                    return -1;
            }
            break;

        default:
            wpa_printf(MSG_MSGDUMP, "unknown vendor specific information "
                    "element ignored (vendor OUI %02x:%02x:%02x "
                    "len=%lu)",
                    pos[0], pos[1], pos[2], (unsigned long) elen);
            return -1;
    }

    return 0;
}


/**
 * ieee802_11_parse_elems - Parse information elements in management frames
 * @start: Pointer to the start of IEs
 * @len: Length of IE buffer in octets
 * @elems: Data structure for parsed elements
 * @show_errors: Whether to show parsing errors in debug log
 * Returns: Parsing result
 */
ParseRes ieee802_11_parse_elems(const u8 *start, size_t len,
        struct ieee802_11_elems *elems,
        int show_errors)
{
    size_t left = len;
    const u8 *pos = start;
    int unknown = 0;

    os_memset(elems, 0, sizeof(*elems));

    while (left >= 2) {
        u8 id, elen;

        id = *pos++;
        elen = *pos++;
        left -= 2;

        if (elen > left) {
            if (show_errors) {
                wpa_printf(MSG_DEBUG, "IEEE 802.11 element "
                        "parse failed (id=%d elen=%d "
                        "left=%lu)",
                        id, elen, (unsigned long) left);
                wpa_hexdump(MSG_MSGDUMP, "IEs", start, len);
            }
            return ParseFailed;
        }

        switch (id) {
            case WLAN_EID_SSID:
                elems->ssid = pos;
                elems->ssid_len = elen;
                break;
            case WLAN_EID_SUPP_RATES:
                elems->supp_rates = pos;
                elems->supp_rates_len = elen;
                break;
            case WLAN_EID_FH_PARAMS:
                elems->fh_params = pos;
                elems->fh_params_len = elen;
                break;
            case WLAN_EID_DS_PARAMS:
                elems->ds_params = pos;
                elems->ds_params_len = elen;
                break;
            case WLAN_EID_CF_PARAMS:
                elems->cf_params = pos;
                elems->cf_params_len = elen;
                break;
            case WLAN_EID_TIM:
                elems->tim = pos;
                elems->tim_len = elen;
                break;
            case WLAN_EID_IBSS_PARAMS:
                elems->ibss_params = pos;
                elems->ibss_params_len = elen;
                break;
            case WLAN_EID_CHALLENGE:
                elems->challenge = pos;
                elems->challenge_len = elen;
                break;
            case WLAN_EID_ERP_INFO:
                elems->erp_info = pos;
                elems->erp_info_len = elen;
                break;
            case WLAN_EID_EXT_SUPP_RATES:
                elems->ext_supp_rates = pos;
                elems->ext_supp_rates_len = elen;
                break;
            case WLAN_EID_VENDOR_SPECIFIC:
                if (ieee802_11_parse_vendor_specific(pos, elen,
                            elems,
                            show_errors))
                    unknown++;
                break;
            case WLAN_EID_RSN:
                elems->rsn_ie = pos;
                elems->rsn_ie_len = elen;
                break;
            case WLAN_EID_PWR_CAPABILITY:
                elems->power_cap = pos;
                elems->power_cap_len = elen;
                break;
            case WLAN_EID_SUPPORTED_CHANNELS:
                elems->supp_channels = pos;
                elems->supp_channels_len = elen;
                break;
            case WLAN_EID_MOBILITY_DOMAIN:
                elems->mdie = pos;
                elems->mdie_len = elen;
                break;
            case WLAN_EID_FAST_BSS_TRANSITION:
                elems->ftie = pos;
                elems->ftie_len = elen;
                break;
            case WLAN_EID_TIMEOUT_INTERVAL:
                elems->timeout_int = pos;
                elems->timeout_int_len = elen;
                break;
            case WLAN_EID_HT_CAP:
                elems->ht_capabilities = pos;
                elems->ht_capabilities_len = elen;
                break;
            case WLAN_EID_HT_OPERATION:
                elems->ht_operation = pos;
                elems->ht_operation_len = elen;
                break;
            default:
                unknown++;
                if (!show_errors)
                    break;
                wpa_printf(MSG_MSGDUMP, "IEEE 802.11 element parse "
                        "ignored unknown element (id=%d elen=%d)",
                        id, elen);
                break;
        }

        left -= elen;
        pos += elen;
    }

    if (left)
        return ParseFailed;

    return unknown ? ParseUnknown : ParseOK;
}


int ieee802_11_ie_count(const u8 *ies, size_t ies_len)
{
    int count = 0;
    const u8 *pos, *end;

    if (ies == NULL)
        return 0;

    pos = ies;
    end = ies + ies_len;

    while (pos + 2 <= end) {
        if (pos + 2 + pos[1] > end)
            break;
        count++;
        pos += 2 + pos[1];
    }

    return count;
}


struct wpabuf * ieee802_11_vendor_ie_concat(const u8 *ies, size_t ies_len,
        u32 oui_type)
{
    struct wpabuf *buf;
    const u8 *end, *pos, *ie;

    pos = ies;
    end = ies + ies_len;
    ie = NULL;

    while (pos + 1 < end) {
        if (pos + 2 + pos[1] > end)
            return NULL;
        if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
                WPA_GET_BE32(&pos[2]) == oui_type) {
            ie = pos;
            break;
        }
        pos += 2 + pos[1];
    }

    if (ie == NULL)
        return NULL; /* No specified vendor IE found */

    buf = wpabuf_alloc(ies_len);
    if (buf == NULL)
        return NULL;

    /*
     * There may be multiple vendor IEs in the message, so need to
     * concatenate their data fields.
     */
    while (pos + 1 < end) {
        if (pos + 2 + pos[1] > end)
            break;
        if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
                WPA_GET_BE32(&pos[2]) == oui_type)
            wpabuf_put_data(buf, pos + 6, pos[1] - 4);
        pos += 2 + pos[1];
    }

    return buf;
}
